NVD has published CVE-2026-54489, a CVSS 9.1 Critical vulnerability affecting Dell Virtual Storage Integrator for VMware vSphere Client versions prior to 10.11.1.0. The defect is described as a sensitive information disclosure issue that is remotely exploitable over the network without authentication. The practical impact is severe: an attacker can obtain active session material and impersonate authenticated users, including administrators.
This is not a routine browser-plugin bug. In environments where Dell VSI is installed into the vSphere Client, a successful attack can become a control-plane compromise: storage provisioning changes, VM power operations, snapshot deletion, datastore modification, role assignment, and follow-on ransomware staging are all plausible if the hijacked session has administrative rights. Treat internet-reachable or broadly reachable vSphere Client and VSI endpoints as urgent exposure.
Source: NVD — CVE-2026-54489.
What is affected
- Product: Dell Virtual Storage Integrator for VMware vSphere Client
- Vulnerable versions: prior to 10.11.1.0
- Fixed version: 10.11.1.0 or later, per Dell recommendation to upgrade at the earliest opportunity
- Exposure pathway: network; unauthenticated remote attacker
- Primary risk: disclosure of sensitive session data, session hijacking, impersonation of authenticated users including administrators
- High-risk deployments: vCenter/vSphere Client reachable from user subnets without segmentation, exposed through reverse proxies, reachable from VPN pools with weak access control, or any direct internet exposure
If your teams use Dell storage integrations inside vSphere Client, assume the plugin should be inventoried even if it was installed years ago by a storage or virtualization team. These integrations often persist through vCenter upgrades because they are registered as extensions rather than obvious workloads.
Technical analysis
The vulnerability pathway is important. NVD classifies CVE-2026-54489 as NETWORK with a 9.1 Critical score, and the summary states that an unauthenticated remote attacker can exploit the issue to disclose sensitive information and hijack sessions. The reported chain is:
- Attacker reaches the vulnerable Dell VSI component exposed through the vSphere Client integration path.
- No valid credentials are required for the initial request.
- The vulnerable component returns or exposes sensitive session material.
- The attacker replays or reuses that material against vSphere Client / vCenter services.
- The attacker operates as the victim user. If the victim is an administrator, the attacker inherits administrative control-plane capability.
From a defender perspective, the most dangerous property is not only information disclosure; it is credential material sufficient for impersonation. That makes the exploit closer to session-token theft than a read-only data leak. Controls that only look for failed logons will miss it. Controls that only patch the plugin but do not invalidate existing sessions may leave stolen sessions valid.
Exploitation status
The provided advisory data does not state that CVE-2026-54489 is in CISA KEV, does not confirm public proof-of-concept code, and does not confirm observed in-the-wild exploitation. Do not use the absence of those confirmations as a reason to defer. The combination of unauthenticated network reachability, active-session theft, and administrator impersonation warrants immediate mitigation and verification.
Why vSphere session hijacking is operationally dangerous
A hijacked vSphere administrative session can be used to:
- Power off or suspend production VMs to create pressure during extortion.
- Delete snapshots, backups, replicas, or datastore content.
- Add SSO users, modify roles, or weaken permissions for persistence.
- Enable ESXi Shell or SSH, then pivot to host-level post-exploitation.
- Change network firewall rulesets to expose management services.
- Deploy or modify appliances, extensions, or storage mappings.
- Access storage-integrated workflows through Dell VSI that may have elevated trust relationships.
The defensive objective is therefore threefold: patch the vulnerable component, invalidate potentially stolen sessions, and detect control-plane actions that are inconsistent with normal administrator behavior.
Detection and response
The detections below are designed for high signal. They are not exploit signatures; the exact vulnerable request path is not published in the source summary. Focus on session anomaly, control-plane changes, and post-compromise VMware administration that follows exposure.
Sigma
Use these rules as behavior-based tripwires around VMware control-plane abuse. Tune scope to vCenter/ESXi management hosts and approved administrator networks before broad deployment.
---
title: VMware ESXi Administrative Persistence or Shell Enablement
description: Detects ESXi host commands associated with creating local accounts, enabling shell or SSH access, or weakening firewall exposure after a possible vSphere session compromise. Tune for approved change windows and administrator networks.
references:
- https://nvd.nist.gov/vuln/detail/CVE-2026-54489
- https://attack.mitre.org/techniques/T1136/
- https://attack.mitre.org/techniques/T1021/
author: Security Arsenal
date: 2026/05/21
status: experimental
id: 2b0b1a2c-7d94-4b7f-9b6a-7c8c5f5a6a11
tags:
- attack.persistence
- attack.t1136
- attack.lateral_movement
- attack.t1021
logsource:
product: linux
category: process_creation
detection:
selection_esxcli_account:
Image|endswith: '/esxcli'
CommandLine|contains:
- 'system account add'
- 'system account set'
selection_shell_ssh:
Image|endswith: '/vim-cmd'
CommandLine|contains:
- 'hostsvc/enable_shell'
- 'hostsvc/start_service'
- 'hostsvc/enable_service'
selection_firewall:
Image|endswith: '/esxcli'
CommandLine|contains:
- 'network firewall ruleset set'
- '--enabled true'
condition: 1 of selection_*
falsepositives:
- Documented ESXi administration during maintenance windows
- Configuration management or host profile remediation
level: high
---
title: VMware VM Destructive Control Operations from Command Line
description: Detects bulk or destructive VM operations such as power off, destroy, snapshot delete, or datastore-related removal initiated through VMware command-line tooling. Intended to catch ransomware-style blast radius after admin session hijack.
references:
- https://nvd.nist.gov/vuln/detail/CVE-2026-54489
- https://attack.mitre.org/techniques/T1485/
- https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/05/21
status: experimental
id: 5e7d2d31-4f7b-4bb2-8d6d-5d27f0a1b901
tags:
- attack.impact
- attack.t1485
- attack.t1490
logsource:
product: linux
category: process_creation
detection:
selection_power:
Image|endswith: '/vim-cmd'
CommandLine|contains:
- 'vmsvc/power.off'
- 'vmsvc/power.suspend'
- 'vmsvc/destroy'
selection_snapshot:
Image|endswith: '/vim-cmd'
CommandLine|contains:
- 'vmsvc/snapshot.remove'
- 'vmsvc/snapshot.removeall'
selection_storage_rm:
CommandLine|contains:
- 'esxcli storage filesystem'
- 'rm -rf /vmfs/volumes'
- 'vsan.'
condition: 1 of selection_*
falsepositives:
- Scripted VM lifecycle automation with approved service accounts
- Storage maintenance executed from known jump hosts
level: high
---
title: Windows Admin Workstation PowerCLI or vSphere Control-Plane Scripting
description: Detects PowerCLI or VMware-related scripting launched from office workstations outside approved automation contexts. Useful where a hijacked browser or stolen admin session is used from an attacker-controlled endpoint to run VMware automation.
references:
- https://nvd.nist.gov/vuln/detail/CVE-2026-54489
- https://attack.mitre.org/techniques/T1059/
- https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/05/21
status: experimental
id: 9a3d81b5-1f79-4d1d-9e0a-4f8e4a1c2c22
tags:
- attack.execution
- attack.t1059.001
- attack.valid_accounts
- attack.t1078
logsource:
product: windows
category: process_creation
detection:
selection_process:
Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
selection_cli:
CommandLine|contains:
- 'Connect-VIServer'
- 'Set-VM'
- 'Remove-VM'
- 'Remove-Snapshot'
- 'Set-VMHost'
- 'Get-VMHostFirewall'
filter_admin_paths:
CurrentDirectory|startswith:
- 'C:\\Program Files\\VMware\\'
- 'C:\\Scripts\\vmware-approved\\'
condition: selection_process and selection_cli and not filter_admin_paths
falsepositives:
- Virtualization administrators running PowerCLI from approved jump hosts
- Scheduled automation under dedicated service accounts
level: medium
Microsoft Sentinel / Defender hunt
Ingest vCenter, ESXi, reverse proxy, load balancer, and firewall telemetry into CommonSecurityLog via CEF/Syslog. Replace the placeholder admin networks and vCenter names with environment values before production use.
let ApprovedAdminNets = dynamic(['10.10.0.0/16','10.20.30.0/24','192.168.50.0/24']);
let vCenterNames = dynamic(['vcenter01.example.local','vcenter02.example.local','vcsa.example.local']);
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where DestinationHostName has_any (vCenterNames)
or DeviceProduct has_any ('vCenter','ESXi','VMware','vSphere')
or Message has_any ('vSphere','vCenter','Dell Virtual Storage Integrator','VSI','session','User logged in')
| extend IsApprovedSource = case(
isempty(SourceIP), false,
SourceIP startswith '10.10.', true,
SourceIP startswith '10.20.30.', true,
SourceIP startswith '192.168.50.', true,
ipv4_is_in_range(SourceIP, '10.10.0.0/16'), true,
ipv4_is_in_range(SourceIP, '10.20.30.0/24'), true,
ipv4_is_in_range(SourceIP, '192.168.50.0/24'), true,
false)
| where IsApprovedSource == false
| extend EventClass = case(
Message has_any ('User logged in','login','session created','authenticated'), 'AuthenticationOrSession',
Message has_any ('power off','delete snapshot','remove all snapshots','destroy','delete'), 'DestructiveControl',
Message has_any ('role','permission','user add','privilege','SSO'), 'PrivilegeOrAccountChange',
Message has_any ('firewall','ssh','shell','TSM'), 'HostExposureChange',
'OtherVMwareEvent')
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Events=count(), DistinctUsers=dcount(SourceUserName), Users=make_set(SourceUserName, 20), SampleMessages=make_set(Message, 5)
by SourceIP, DestinationHostName, DeviceProduct, EventClass
| where Events >= 3 or EventClass in ('DestructiveControl','PrivilegeOrAccountChange','HostExposureChange')
| order by LastSeen desc
Add a second validation query for endpoint-to-vCenter paths when you suspect an attacker is operating from a workstation rather than directly from the internet:
let vCenterIPs = dynamic(['10.10.10.15','10.10.10.16','192.168.50.15']);
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemotePort == 443 and RemoteIP in (vCenterIPs)
| join kind=inner (DeviceProcessEvents | project DeviceId, ProcessId, FileName, ProcessCommandLine, AccountName, TimeGenerated) on DeviceId
| where FileName !in~ ('chrome.exe','msedge.exe','firefox.exe','powershell.exe','pwsh.exe','govc.exe','kubectl.exe')
or ProcessCommandLine has_any ('Connect-VIServer','vim-cmd','esxcli','Remove-VM','Set-VMHost')
| summarize Connections=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Commands=make_set(ProcessCommandLine, 10)
by DeviceName, AccountName, FileName, RemoteIP
| order by Connections desc
Velociraptor hunt
Run this against administrator workstations, jump hosts, and any endpoint that accesses the vSphere Client. It looks for browser or automation processes talking to vCenter and for non-browser processes holding 443 sessions to virtualization infrastructure.
-- Hunt endpoints with active or recent processes referencing vSphere/VSI and non-browser TLS sessions to vCenter
SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(vsphere|vcenter|dell virtual storage integrator|\bvsi\b|Connect-VIServer|vim-cmd|esxcli)'
OR Exe =~ '(?i)(chrome|msedge|firefox|powershell|pwsh|govc|vim-cmd|esxcli)'
-- Correlate TLS connections to likely vCenter/VSI infrastructure with owning process
SELECT Pid, Name, Exe, Username, Laddr, Raddr, Status
FROM netstat()
WHERE Raddr =~ ':443'
AND Name !~ '(?i)(chrome|msedge|firefox|iexplore)'
AND (Exe =~ '(?i)(powershell|pwsh|python|rclone|curl|wget|java)' OR CommandLine =~ '(?i)(vsphere|vcenter|esxcli|Connect-VIServer)')
Verification and containment script
Use govc from an isolated management host with read-only credentials first. The unregistration action is intentionally gated behind an explicit environment variable. Test in a lab or maintenance window because extension removal can affect storage workflows.
#!/usr/bin/env bash
set -euo pipefail
# Required: export GOVC_URL='https://vcenter01.example.local/sdk'
# Required: export GOVC_USERNAME='readonly-audit@vsphere.local'
# Required: export GOVC_PASSWORD='...'
# Optional: GOVC_INSECURE=true only for lab validation
: "${GOVC_URL:?Set GOVC_URL}"
: "${GOVC_USERNAME:?Set GOVC_USERNAME}"
: "${GOVC_PASSWORD:?Set GOVC_PASSWORD}"
need() { command -v "$1" >/dev/null 2>&1 || { echo "Missing dependency: $1"; exit 1; }; }
need govc
version_lt() {
# returns 0 if $1 < $2
[ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" != "$2" ]
}
echo "[+] Enumerating vSphere extensions that look like Dell VSI/storage integrations"
mapfile -t EXT_LINES < <(govc extension.info 2>/dev/null | egrep -i 'dell|virtual storage integrator|storage integrator|\bvsi\b|extension|version' || true)
if [ ${#EXT_LINES[@]} -eq 0 ]; then
echo "[!] No Dell/VSI-like extensions returned by govc extension.info. Manually check Administration > Client Plugins and ExtensionManager."
fi
FOUND=0
while IFS= read -r line; do
echo " $line"
if printf '%s' "$line" | egrep -qi 'dell|virtual storage integrator|storage integrator|\bvsi\b'; then
FOUND=1
ver=$(printf '%s' "$line" | egrep -io '([0-9]+\.){3}[0-9]+' | head -n1 || true)
key=$(printf '%s' "$line" | awk '/Key:|Name:|Extension/{print $2}' | head -n1 || true)
if [ -n "$ver" ]; then
if version_lt "$ver" "10.11.1.0"; then
echo "[VULNERABLE] Detected VSI-like version $ver (< 10.11.1.0). Upgrade to 10.11.1.0+ immediately."
if [ "${ALLOW_UNREGISTER:-false}" = "true" ] && [ -n "$key" ]; then
echo "[CONTAIN] ALLOW_UNREGISTER=true set; unregistering extension key: $key"
govc extension.unregister "$key" || echo "[WARN] unregister failed for $key"
else
echo "[ACTION] If unused and cannot patch today, consider approved temporary unregistration: ALLOW_UNREGISTER=true $0"
fi
else
echo "[OK] Detected VSI-like version $ver appears patched relative to 10.11.1.0. Confirm vendor release notes."
fi
fi
fi
done <<< "$(printf '%s\n' "${EXT_LINES[@]}")"
if [ "$FOUND" -eq 0 ]; then
echo "[*] No obvious Dell VSI extension identifier matched. Inventory plugins in vSphere Client and Dell storage tooling before closing."
fi
echo "[+] Recent tasks/events hinting at destructive or privilege changes"
govc events -n 200 2>/dev/null | egrep -i 'powered off|destroy|delete|snapshot|permission|role|user|ssh|shell|firewall|extension' | tail -n 100 || true
Remediation
- Upgrade immediately to Dell Virtual Storage Integrator for VMware vSphere Client 10.11.1.0 or later. Do not rely solely on network controls if the plugin remains installed and vulnerable.
- Inventory all vCenter Server instances for the Dell VSI extension/plugin. Check ExtensionManager, client plugins, storage team documentation, change records, and any Dell storage deployment automation that may reinstall an older plugin.
- If the integration is unused and cannot be patched today, remove or disable it through an approved change. Prefer vendor-supported removal. Verify storage workflows after removal; some teams depend on VSI for provisioning or visibility.
- Invalidate sessions after patching. Force reauthentication for vSphere Client/SSO users, rotate privileged credentials, revoke API tokens, and review active sessions. A patch does not erase session material already disclosed.
- Rotate secrets that could have been exposed through an admin session. Prioritize vCenter SSO administrators, AD accounts used for vSphere, service accounts with PowerCLI/govc access, storage-array credentials reachable from virtualization tooling, and any saved credentials in admin browsers or password vaults recently used on affected systems.
- Restrict reachability. vCenter, ESXi management, and plugin endpoints should not be internet reachable. Limit TCP 443 to vSphere Client from named admin networks or jump hosts. Enforce MFA at the identity layer and device posture checks for admin access where supported.
- Review logs for post-exposure control-plane activity. Look for VM power operations, snapshot deletion, datastore removal, SSO user creation, permission changes, ESXi Shell/SSH enablement, firewall ruleset changes, extension registration, and logins from unfamiliar source IPs or user agents.
- Protect recovery paths. Confirm offline/immutable backups, verify restore of at least one critical VM, and ensure backup infrastructure is not manageable through the same hijacked vSphere admin session.
- Monitor authoritative sources. Track the NVD entry, Dell Technologies security advisories and support notifications, and CISA KEV for changes in exploitation status. If CISA adds the CVE to KEV, apply the associated federal remediation deadline as your minimum bar even if you are not a federal entity.
- Close the loop with validation. After upgrade, re-run extension inventory, confirm the version is 10.11.1.0 or higher, validate that stale sessions were revoked, and run the hunt queries above across a lookback window that covers the exposure period.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.